CVE-2024-47083
📋 TL;DR
The Power Platform Terraform Provider versions before 3.0.0 expose service principal client_secret values in logs due to improper masking. This allows anyone with access to logs to steal authentication credentials. Organizations using affected versions for Power Platform infrastructure management are impacted.
💻 Affected Systems
- Microsoft Power Platform Terraform Provider
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative access to Power Platform environments, enabling data theft, resource destruction, or lateral movement to connected systems.
Likely Case
Unauthorized users with log access obtain service principal credentials and perform unauthorized operations within Power Platform environments.
If Mitigated
With proper log access controls and credential rotation, impact is limited to credential exposure requiring rotation.
🎯 Exploit Status
Exploitation requires access to logs containing exposed credentials. No special tools needed beyond log access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.0
Vendor Advisory: https://github.com/microsoft/terraform-provider-power-platform/security/advisories/GHSA-7w3w-pjm5-m36c
Restart Required: No
Instructions:
1. Update Terraform configuration to use provider version >=3.0.0. 2. Run 'terraform init -upgrade'. 3. Apply configuration changes.
🔧 Temporary Workarounds
Disable persistent logging
allPrevent logs from being written to disk or external systems
unset TF_LOG_PATH
export TF_LOG_PATH=
Use OIDC authentication
allSwitch from client_secret to OpenID Connect authentication
🧯 If You Can't Patch
- Immediately rotate all service principal client_secrets used with affected provider
- Disable TF_LOG_PATH environment variable and remove existing log files
🔍 How to Verify
Check if Vulnerable:
Check Terraform configuration for 'microsoft/power-platform' provider version <3.0.0Check Version:
terraform versionVerify Fix Applied:
Confirm provider version is >=3.0.0 in .terraform.lock.hcl📡 Detection & Monitoring
Log Indicators:
- client_secret values in Terraform logs
- Power Platform authentication logs showing unexpected service principal usage
Network Indicators:
- Unusual API calls to Power Platform from unexpected locations
SIEM Query:
source="terraform.log" AND "client_secret"🔗 References
- https://github.com/microsoft/terraform-provider-power-platform/releases/tag/v3.0.0
- https://github.com/microsoft/terraform-provider-power-platform/security/advisories/GHSA-7w3w-pjm5-m36c
- https://registry.terraform.io/providers/microsoft/power-platform/latest/docs#authenticating-to-power-platform-using-a-service-principal-with-oidc
